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Abstract 


A  software  tool  was  designed  and  implemented  that  leads  accident  investigators  through  the 
steps  of  a  Systematic  Error  and  Risk  Analysis  (SERA),  a  classification  scheme  based  on 
Perceptual  Control  Theory  and  developed  at  DRDC  Toronto  The  software  presents  an 
investigator  with  a  series  of  questions  about  an  accident  and  generates  conclusions  about  the 
nature  of  the  failure  and  its  probable  pre-conditions.  A  graphical  depiction  of  the  decision 
tree  allows  users  to  navigate  easily  among  the  steps  of  the  analysis  At  the  end  of  the  process, 
the  software  produces  a  report  detailing  failures  and  pre-conditions,  and  providing  equivalent 
terminology  from  the  AGA  135  HFACS  classification  scheme 

A  help  system  was  developed  that  makes  context-sensitive  help  available  to  the  user  at 
various  stages  of  the  process  In  preliminary  work  to  lay  a  foundation  for  intelligent  aiding, 
users’  activities  are  tracked  by  the  software  m  a  way  that  can  be  used  in  future  to  provide 
intelligent  and  adaptive  help  To  illustrate  the  potential  use  of  the  tracking  mechanism,  the 
software  was  designed  to  monitor  user  actions  and  offer  help  whenever  there  is  a  long  delay 
without  input 


Resume 


On  a  con^u  et  mis  en  oeuvre  un  outil  logiciel  qui  aide  les  enqueteurs  d’accident  a  executer  les 
etapes  d’une  analyse  systematique  des  erreurs  et  du  risque  (SERA),  systeme  de  classification 
base  sur  les  principes  du  controle  perceptif  et  developpe  par  le  RDDC  Toronto  Le  logiciel 
presente  a  l’enqueteur  une  serie  de  questions  sur  un  accident  et  genere  des  conclusions  sur  la 
nature  de  la  defaillance  et  les  conditions  prealables  probables  Une  representation  graphique 
de  Tarbre  de  decision  permet  aux  utilisateurs  de  naviguer  aisement  parmi  les  etapes  de 
l’analyse  A  la  fin  du  processus,  le  logiciel  produit  un  rapport  detaillant  les  defaillances  et  les 
conditions  prealables  et  foumissant  la  terminologie  equivalente  du  systeme  de  classification 
duSACFH  AGA  135 

On  a  developpe  un  systeme  d’aide  contextuelle  auquel  Tutihsateur  peut  avoir  recours  aux 
diverses  etapes  du  processus  Au  stade  preliminaire,  en  vue  d’etablir  une  fondation  pour  l’aide 
intelligente,  les  activites  des  utilisateurs  sont  suivies  de  pres  par  le  logiciel  d’une  fafon  qui 
pourra  etre  utilisee  a  l’averur  pour  offnr  de  l’aide  intelligente  et  adaptative  A  titre 
d’lllustration  de  l’utilisation  potentielle  du  mecanisme  de  suivie  des  activites,  le  logiciel  a  ete 
confu  pour  surveiller  les  actions  de  l’utilisateur  et  offnr  de  l’aide  lorsqu’il  y  a  un  intervalle 
prolonge  sans  entree 
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Executive  Summary _ 

A  software  tool  was  designed  and  implemented  that  leads  accident  investigators  through  the 
steps  of  a  Systematic  Error  and  Risk  Analysis  (SERA),  a  classification  scheme  developed  at 
DRDC  Toronto  That  scheme  combines  Information  Processing  and  Perceptual  Control 
theories  into  a  model  for  investigating  accidents  and  preventing  future  recurrences 

The  SERA  tool  presents  an  investigator  with  a  series  of  questions  about  an  accident  and 
generates  conclusions  about  the  nature  of  the  failure  and  its  probable  pre-conditions  Users 
are  able  to  modify  responses  to  previous  questions  using  a  familiar  “wizard”  interface  that 
contains  choice  points  with  “Next”  and  “Previous”  buttons  Introductory  questions  require 
textual  descriptions  and  are  followed  by  Yes/No  questions  with  areas  for  adding  additional 
remarks  Answers  to  the  Yes/No  questions  determine  the  user’s  path  through  a  decision  tree 
and  result  in  sets  of  conclusions  about  active  failures  and  concomitant  pre-conditions  If  any 
conclusion  does  not  agree  with  the  user’s  understanding  of  the  situation,  SERA  initiates  a 
review  of  previous  answers  to  help  resolve  the  discrepancy 

SERA  includes  a  Flowchart  Window  with  a  graphical  depiction  of  its  decision  tree  The 
nodes  of  the  tree  are  selectable  and  users  can  navigate  quickly  and  easily  among  the  steps  of 
the  analysis  with  a  simple  click  of  the  mouse  Pop-up  labels  provide  brief  descriptions  of  the 
nodes  and  appear  whenever  the  user  pauses  the  cursor  over  an  item  Nodes  and  links  are 
coded  by  colour  and  shape  to  indicate  their  type  and  a  legend  appears  in  one  comer  of  the 
flowchart  window  to  help  users  discriminate  among  them 

At  the  end  of  the  process,  SERA  produces  a  report  detailing  failures  and  pre-conditions,  and 
providing  equivalent  terminology  from  the  AGA  135  HFACS  classification  scheme,  currently 
in  use  by  the  Canadian  Forces  Users  also  have  the  ability  to  override  the  default  HFACS 
terminology  and  specify'  other  equivalents  In  addition  to  being  able  to  export  the  report  to  a 
text  file,  which  can  be  re-fonnatted  easily  in  a  word  processor  to  suit  the  needs  of  the  user,  the 
complete  file,  containing  all  of  the  interface  information,  can  be  saved  and  returned  to  it  at  a 
later  time 

A  help  system  was  developed  that  makes  context-sensitive  help  available  to  the  user  at 
various  stages  of  the  process  Help  screens  can  be  accessed  from  most  windows  by  clicking 
on  a  question-mark  icon  and  additional  explanations  appear  in  pop-up  windows  when  the  user 
pauses  the  cursor  over  the  description  of  a  failure 

In  preliminary'  work  to  lay  a  foundation  for  intelligent  aiding,  users'  activities  are  tracked  by 
the  software  in  a  way  that  can  be  used  in  future  to  provide  adaptive  help  To  illustrate  the 
potential  use  of  the  tracking  mechanism,  the  software  was  designed  to  monitor  user  actions 
and  offer  help  whenever  there  is  a  long  delay  without  input  The  activities  of  the  tracking 
mechanism  are  stored  in  a  log  of  user  actions  maintained  by  the  system  Future  work  will 
modify  those  representations  in  ways  that  permit  more  effective  intelligent  and  adaptive 
aiding  for  the  SERA  user 
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SERA  was  written  in  Java  to  provide  maximum  flexibility  for  future  enhancements  while 
ensuring  cross-platform  compatibility  Versions  have  been  delivered  for  Windows  and 
Macintosh  platforms,  but  in  future  the  software  could  be  ported  to  a  variety  of  other  systems, 
including  web  browsers  and  handheld  devices  such  as  the  Palm  or  PocketPC  thereby  allowing 
investigators  to  conduct  SERA  analyses  in  the  field 


Edwards,  J  L  2002  Design  and  Implementation  of  a  Software  Tool  for  Human  Factors 
Accident  Investigation  and  Classification  (PCTACT)  AC242,  DRDC  Toronto  CR  2002-168 
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Sommaire 


On  a  con^u  et  mis  en  oeuvre  un  outil  logiciel  qui  aide  les  enqueteurs  d’ accident  a  executer  les 
etapes  d’une  analyse  systematique  des  erreurs  et  du  risque  (SERA),  systeme  de  classification 
base  sur  les  prmcipes  du  controle  perceptif  et  developpe  par  le  RDDC  Toronto  Ce  systeme 
combine  les  prmcipes  du  traitement  de  l’information  et  du  controle  perceptif  dans  un  modele 
pour  enqueter  sur  les  accidents  et  empccher  les  recurrences  futures 

L’outil  SERA  presente  a  f  enqueteur  une  serie  de  questions  sur  un  accident  et  genere  des 
conclusions  sur  la  nature  de  la  defaillance  et  les  conditions  prealables  probables  Les 
utihsateurs  peuvent  modifier  leurs  reponses  aux  questions  precedentes  au  moyen  d’une 
interface  d’assistant  famihere  qui  contient  des  options  avec  des  boutons  Suivant  (Next)  et 
Precedent  (Previous)  Des  questions  prehminaires  exigent  des  descriptions  texte  et  sont 
suivies  de  questions  de  type  oui/non  avec  des  champs  permettant  d'entrer  des  remarques 
supplementaires  Les  reponses  aux  questions  oui/non  determinent  le  chemin  de  l’utilisateur 
dans  un  arbre  de  decision  et  donnent  lieu  a  des  ensembles  de  conclusions  au  sujet  de 
defaillances  actives  et  des  conditions  prealables  connexes  Si  une  conclusion  donnee  ne 
concorde  pas  avec  1’ interpretation  de  la  situation  par  futilisateur,  SERA  lance  une  revue  des 
reponses  anteneures  pour  aider  a  resoudre  la  divergence 

SERA  comprend  une  fenetre  a  ordinogramme  avec  une  representation  graphique  de  l’arbre  de 
decision  Les  noeuds  de  l’arbre  sont  selectionnables,  et  les  utihsateurs  peuvent  naviguer 
rapidement  et  aisement  parmi  les  etapes  de  f  analyse  au  moyen  d  un  simple  clic  de  la  souns 
Des  etiquettes  mstantanees  donnent  de  breves  descriptions  des  noeuds,  et  elles  apparaissent 
lorsque  futilisateur  arrete  le  curseur  sur  un  noeud  Les  noeuds  et  les  liens  sont  a  code  de 
couleur  et  de  forme  indiquant  leur  type,  et  une  legende  apparait  dans  un  des  coins  de  la  fenetre 
a  ordinogramme  pour  aider  futilisateur  a  les  distinguer  les  uns  des  autres 

A  la  fin  du  processus,  SERA  produit  un  rapport  detaillant  les  defaillances  et  les  conditions 
prealables  et  foumissant  la  terminologie  equivalente  du  systeme  de  classification  du  SACFH 
AGA  135,  actuellement  utilise  par  les  Forces  canadiennes  De  plus,  les  utihsateurs  ont  la 
possibility  de  surpasser  la  terminologie  implicite  du  SACFH  et  de  specifier  d’autres 
equivalents  En  plus  de  la  possibility  d’exporter  le  rapport  vers  un  fichier  texte,  qui  peut  etre 
reformate  aisement  dans  un  traitement  de  texte  selon  les  besoms  de  futilisateur,  le  fichier 
complet,  comprenant  toute  f  information  d’interface,  peut  etre  sauvegarde  pour  y  revemr  plus 
tard 

On  a  developpe  un  systeme  d’aide  contextuelle  auquel  futilisateur  peut  avoir  recours  aux 
diverses  etapes  du  processus  On  accede  aux  ecrans  d’aide  a  partir  de  la  plupart  des  fenetres 
en  cliquant  sur  une  icone  a  point  d’mterrogation,  et  des  explications  supplementaires 
apparaissent  dans  des  fenetres  mstantanees  lorsque  futilisateur  arrete  le  curseur  sur  la 
description  d’une  defaillance 

Au  stade  prehminaire,  en  vue  d’etabhr  une  fondation  pour  f  aide  mtelhgente,  les  activites  des 
utihsateurs  sont  suivies  de  pres  par  le  logiciel  d'une  fafon  qui  pourra  etre  utihsee  a  f  avenir 
pour  offrir  de  f  aide  adaptative  A  titre  d’lllustration  de  f  utilisation  potentielle  du  mecanisme 
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de  suivie  des  activites,  le  logiciel  a  ete  con?u  pour  surveiller  les  actions  de  l’utilisateur  et 
offrir  de  l’aide  lorsqu’il  y  a  un  mtervalle  prolonge  sans  entree  Les  activites  du  mecamsme  de 
suivi  sont  stockees  dans  un  journal  des  actions  utilisateur  maintenu  par  le  systeme  Les 
travaux  futurs  modifieront  ces  representations  de  fafon  a  offrir  a  l’utilisateur  de  SERA  de 
l’aide  intelligente  et  adaptative  plus  efficace. 

SERA  a  ete  ecnt  en  Java  pour  offrir  une  souplesse  maximale  aux  ameliorations  futures  tout  en 
assurant  la  compatibility  inter-plates-formes  Des  versions  ont  ete  livrees  pour  les  plates- 
formes  Windows  et  Macintosh,  mais  a  Lavemr  le  logiciel  pourrait  etre  adapte  a  une  variete 
d’autres  systemes,  y  compris  les  explorateurs  Web  et  des  dispositifs  portatifs  tels  que  les 
ordinateurs  de  poche  Palm  ou  PocketPC,  ce  qui  permettra  aux  enqueteurs  d’effectuer  les 
analyses  SERA  sur  le  terrain 


VI 
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Background _ 

Identifying  and  eliminating  factors  that  lead  to  accidents  is  essential  to  preventing  future 
recurrences  Due  to  advances  in  equipment  reliability,  accidents  are  more  likely  to  be  the 
result  of  human  error  than  mechanical  error  To  facilitate  the  investigation  of  human  errors,  it 
is  useful  to  have  a  systematic  process  for  analysing  the  causes  of  failures  and  conditions  that 
lead  to  those  failures  One  such  system  is  the  Perceptual  Control  Theory  Accident 
Classification  Tool  (PCTACT1)  (Hendy,  2002)  While  other  accident  investigation  tools  are 
based  on  descriptive  models,  SERA  is  grounded  in  a  theoretical  approach  that  combines 
Information  Processing  and  Perceptual  Control  theories  (Hendy,  East,  and  Farrell,  2000; 
Hendy,  Liao,  and  Milgram,  1997,  Powers,  1973)  SERA  provides 


•  a  tool  for  investigating  the  human  factors  causes  of  accidents  and  incidents, 

•  a  means  of  classifying  accidents  and  incidents,  and 

•  the  basis  for  a  risk  management  tool 

To  prevent  future  accidents,  their  causes  need  to  be  identified  and  steps  taken  to  eliminate  the 
conditions  that  led  to  the  errors  Current  accident  investigation  tools,  such  as  the  Human 
Factors  Accident  Classification  System  (HFACS)  used  by  the  Canadian  Forces  Directorate  of 
Flight  Sal’efy,  have  been  developed  by  analysing  factors  that  contributed  to  a  series  of  specific 
accidents  Because  they  lack  a  sound  theoretical  foundation,  it  is  difficult  to  say  whether  they 
model  cause  and  effect  relationships  in  a  consistent  and  reliable  manner  In  contrast,  SERA 
provides  a  theoretical  basis  for  identifying  cause  and  effect  relations  in  accident  investigations 
and  is  subject  to  checks  on  consistency  and  completeness  as  well  as  reliability  and  validity 


In  addition  to  helping  determine  the  type  of  failure  that  occurred,  SERA  identifies  the  most 
likely  pre-conditions  that  led  to  the  failure  These  are  conditions  that  would  have  to  be 
changed  in  order  to  prevent  a  recurrence  of  the  incident  A  significant  advantage  of  SERA  is 
that  it  provides  a  more  comprehensive  taxonomy  of  failures  and  pre-conditions  than  existing 
accident  investigation  and  classification  tools  like  HFACS  HFACS  (Shappell  and 
Wiegmann,  2000)  was  developed  by  analysing  a  database  of  specific  accidents,  so  there  is  the 
risk  that  its  taxonomy'  is  incomplete  or  redundant  due  to  limitations  in  the  data  In  contrast, 
the  theoretical  underpinnings  of  the  SERA  model  help  ensure  the  development  of  a  consistent 
and  complete  taxonomy' 


In  order  to  facilitate  the  use  of  the  SERA  model,  a  softw  are  representation  of  the  system  is 
needed  to  provide  accident  investigators  with  an  efficient  way  to  perform  SERA  analyses 
Such  a  softw  are  tool  also  would  facilitate  the  collection  of  data  that  could  help  refine  the 
SERA  model  itself  This  project  aims  to  address  these  issues 


Throughout  the  rest  of  this  report,  the  name  ot  the  software  will  reflect  the  recent  name  change  of 
“Systematic  Error  and  Risk  Analysis”  and  the  associated  acronym,  ’’SERA.” 


P518636.PDF  [Page:  15  of  47] 


The  purpose  of  this  contract  will  be  to  design  and  build  a  software  tool  that  will  lead  accident 
investigators  through  the  steps  of  a  SERA  analysis  The  software  tool  will  present  the 
investigator  with  a  series  of  questions  and  analyse  the  respondent’s  answers  in  terms  of  the 
source  of  failure  and  pre-conditions  that  led  to  that  failure  In  addition  to  providing  standard, 
context-sensitive  help  to  the  user,  the  tool  will  lay  a  foundation  for  intelligent  aiding  and 
incorporate  one  or  more  examples  in  the  final  implementation 
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Research  Approach _ 

Using  IP/PCT  theory  and  Hendy’s  derived  SERA  conceptual  tool,  a  comparable  software 
system  was  to  be  designed  and  implemented  The  software  tool  would  take  a  user  through  a 
step-by-step  process  that  characterizes  accidents  in  terms  of  active  failures  and  their  pre¬ 
conditions  and  would  be  designed  for  accident  investigators  as  they  gather  information  m  the 
field  The  principal  elements  of  the  program  were  to  be.  an  easy  to  use  interface,  standard 
and  intelligent  help,  and,  cross-comparisons  to  similar  results  from  the  HFACS  tool 

The  proposed  SERA  tool  would  be  designed  to  lead  the  investigator  through  a  series  of  yes  or 
no  questions  modelled  on  Hendy’s  flowcharts  These  questions  would  follow  decision 
ladders  which  lead  to  conclusions  about  the  active  failures  that  caused  the  accident  and  the 
pre-conditions  that  led  to  those  failures  At  the  conclusion  of  the  question-answering  phase, 
the  SERA  tool  would  present  the  user  with  a  report  detailing  the  type(s)  of  failure  that  led  to 
the  accident  and  the  associated  pre-conditions,  as  well  as  equivalent  terminology  from  the 
Canadian  Forces  modified  AGA  135  HFACS  specification 

Help  would  be  made  available  to  the  user  at  each  stage  in  the  process  For  each  question 
presented,  context-sensitive  help  would  be  readily  accessible  including  definitions  of  terms 
and  descriptions  of  factors  to  consider  in  answering  the  particular  question  A  graphical 
overv  iew  of  the  line  of  questioning  was  to  show  where  the  user  is  in  the  process  thereby 
providing  a  better  understanding  of  the  overall  procedure  The  software  also  was  to 
incorporate  a  foundation  for  intelligent  aiding  by  tracking  an  investigator’s  interface  actions 
Among  other  things,  the  user  interface  tracking  was  to  include  information  about  the  timing  of 
the  user’s  input,  allowing  the  system  to  offer  help  to  the  user  when  it  detects  a  long  delay  in 
answering  a  question 


Study  Objectives  and  Work  Items 

The  following  study  objectives  and  work  items  were  identified  for  this  project: 

•  To  design  and  build  a  software  tool  that  will  lead  accident  investigators  through  the  steps 
of  a  SERA  analysis  The  software  will  have  the  following  features 

•  A  clear,  intuitive  interface  that  presents  the  user  with  a  series  of  questions  based 
on  the  decision  ladders  outlined  in  the  Hendy’s  PCTACT  (SERA)  technical 
report 

•  Summary  conclusions  about  the  nature  of  the  failure  and  probable  pre-conditions 
that  could  have  led  to  that  type  of  failure 

•  A  report  detailing  these  findings 

•  A  revision  support  function  allowing  users  to  modify  responses  to  previous 
questions 


3 


P518636.PDF  [Page:  17  of  47] 


•  Context-sensitive  help  at  each  stage  of  the  analysis,  with  definitions  of  terms  and 
other  relevant  background  information  presented 

•  To  construct  a  database  to  accommodate  the  results  of  SERA  analyses  and  link  the  SERA 
tool  with  that  database 

•  To  provide  for  cross-comparisons  to  HFACS  terminology 

•  To  provide  support  for  intelligent  aiding  in  the  following  forms 

•  Tracking  of  user  interface  actions, 

•  Offering  of  help  when  there  are  excessively  long  delays  without  user  input, 

•  Offering  of  help  in  the  face  of  apparent  confusion  on  the  part  of  the  user  (e  g 
when  the  user  repeatedly  returns  to  modify  answers  to  previous  questions), 

•  Possibly  incorporating  an  information-retrieval  agent  for  obtaining  up-to-date 
information  on  failures  and  pre-conditions  from  the  world  wide  web 
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The  Main  SERA  Window 


The  mam  SERA  window  presents  information  in  a  variety  of  formats,  depending  on  where  the 
user  is  in  the  process  These  screens  include  preliminary  information  on  the  investigator  and 
the  accident;  descriptions  and  remarks  about  the  unsafe  act  and  the  perceptions,  goals  and 
actions  of  the  crew;  Yes/No  questions,  conclusions  about  failures,  candidate  pre-conditions; 
help,  conflict  resolution,  and  report  Following  a  description  of  the  introductory  splash  screen 
and  tire  nature  of  navigation  within  the  SERA  software  tool,  detailed  descriptions  of  these 
screens  are  given 

Splash  Screen 

This  screen  appears  when  the  program  is  first  launched  and  can  also  be  triggered  from  the 
“About  SERA”  item  in  the  Help  Menu  The  window  includes  the  title  of  the  software,  the 
author  and  commissioner  of  the  software,  and  copyright  information  The  accompanying 
graphic  depicts  a  CF-18,  a  Halifax-class  frigate  and  a  Coyote  personnel  carrier  (representing 
the  three  services  of  the  Canadian  Forces)  as  well  as  a  maintainer  working  on  a  CF-18  The 
splash  screen  can  be  dismissed  by  clicking  anywhere  in  the  window 


Navigation 


Navigation  among  the  questions  in  the  SERA  analysis  is  accomplished  by  using  “Next”  and 
“Previous”  buttons  which  are  located  in  the  bottom-right  comer  of  each  screen  This  enables 
users  to  easily  move  among  the  questions  and  conclusions  in  the  same  familiar  manner  that 
they  would  navigate  m  a  standard  “wizard”  interface 

The  primary'  benefit  of  navigating  using  the  “Next”  and  “Previous”  buttons  is  that  it  provides 
a  simple  way  for  the  user  to  return  to  examine  prior  responses  while  preserving  the  state  of  all 
subsequent  answers 

Users  can  also  navigate  by  clicking  items  in  the  flowchart  window  This  allows  the  user  to 
rapidly  move  to  other  locations  in  the  decision  tree  without  the  need  to  repeatedly  click  the 
“Next”  and  “Previous”  buttons  (See  the  “SERA  Flowchart  Window”  section  below  ) 

Each  time  the  user  navigates  to  a  new  screen,  a  transition  effect,  much  like  those  used  in 
PowerPoint  and  other  presentation  software,  is  used  to  give  a  visual  cue  as  to  the  direction  of 
the  movement  in  the  decision  tree  Downward  motion  in  the  tree  is  conveyed  by  scrolling  the 
new  screen  up  from  the  bottom  Similarly,  lateral  movements  in  the  tree  result  in  the  new 
screen  scrolling  from  the  right  side  of  the  window  Box-out  transitions  are  used  m  situations 
where  the  user  is  jumping  ahead  to  a  discrete  location  in  the  decision  tree  When  the 
“Previous”  button  is  clicked,  the  transitions  move  in  the  opposite  direction  A  horizontal 
blind  effect  is  used  when  help  is  presented,  and  the  effect  is  reversed  when  the  help  is 
dismissed 
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Introduction  Screen 

This  screen  presents  the  investigator  with  a  brief  description  of  the  software  and  prompts  the 
user  to  enter  some  basic  information  This  includes  the  author,  the  author’s  unit,  the  title  of 
the  report,  a  brief  description  of  the  incident,  and  the  dates  and  times  of  both  the  incident  and 
tire  entry  of  the  report  When  the  program  is  first  launched,  the  report  date  and  time  are  filled 
in  automatically  with  current  values 

The  user  can  click  on  the  astensked(*)  “Perceptual  Control  Theory”  footnote  at  the  bottom, 
left-hand  comer  of  this  window  Doing  so  brings  up  a  brief  description  of  the  theory  for 
interested  users 


Questions  Requiring  Textual  Responses 

There  are  two  types  of  question  in  the  SERA  tool  those  that  require  textual  answers  from  the 
user,  and  those  that  need  a  “yes”  or  “no”  response  The  first  four  questions  in  the  analysis  are 
of  the  first  type  and  the  remainder  fall  into  the  second  category  The  Ycs/No  question  screens 
also  provide  a  place  to  enter  textual  responses  and,  for  each  question,  this  area  is  appropriately 
labelled  so  as  to  provide  guidance  to  the  user  on  the  nature  of  the  descriptions  to  be  entered 

The  first  four  questions  require  the  user  to  identify  the  following 

•  the  unsafe  act  that  led  to  the  accident, 

•  the  crew’s  perceptions  as  they  relate  to  the  unsafe  act, 

•  the  goals  of  the  crew,  and, 

•  the  crew’s  actions 

Textual  answers  arc  entered  into  an  editable  text  area  which  follows  each  question  A  second 
text  area  allows  the  entry'  of  any  additional  remarks  the  investigator  may  have  These  remarks 
provide  details  on  the  incident  being  investigated  that  can  be  useful  to  other  investigators 
reviewing  the  results 


Questions  Requiring  “Yes”  or  “No”  Responses 

The  question  screens  that  call  for  “Yes”  or  “No”  responses  form  the  backbone  of  the  SERA 
decision  trees  The  user’s  answers  to  these  questions  determine  the  path  through  the  decision 
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tree  and  thereby  result  in  conclusions  about  the  active  failures  and  concomitant  pre-conditions 
which  led  to  the  accident 

In  the  early  stages  in  the  development  of  this  software,  the  yes  or  no  answers  were  selected 
using  radio  buttons,  w  hich  due  to  their  nature  had  the  potential  to  mislead  the  user  into 
thinking  one  answer  was  more  probable  or  desirable  than  another  To  avoid  this  problem,  a 
new  interface  element  was  designed  using  “Yes”  and  “No”  labels  that  appear  below  each 
question  When  a  question  is  first  displayed,  neither  item  is  highlighted  To  provide  feedback 
to  the  user  that  the  items  are  selectable,  a  faint  grey  ellipse  encircles  each  item  when  the 
mouse  pointer  passes  over  top  When  the  user  selects  either  “Yes”  or  “No”,  that  item  is 
circled  in  white  to  indicate  the  user’s  choice 

As  with  the  first  four  questions,  there  is  a  text  area  which  permits  the  entry  of  any  additional 
remarks  the  user  may  have  In  the  case  of  the  Yes/No  questions,  the  title  of  this  text  area 
changes  according  to  the  particular  question  This  guides  the  user  to  provide  specific 
information  relevant  to  that  question 


Conclusion  Screens 

When  the  user  has  answered  enough  questions  for  the  software  to  come  to  a  determination 
about  failures  that  may  have  occurred,  this  information  is  presented  in  a  conclusion  screen 
Each  conclusion  screen  gives  the  user  a  list  of  one,  two  or  three  possible  failures  depending 
on  the  context  If  none  of  the  conclusions  seems  appropriate  to  the  user,  the  following, 
additional  choice  is  available  “The  above  conclusion(s)  do  not  fit  with  my  understanding  of 
the  situation  ”  Selecting  this  option  and  clicking  the  “Next”  button  takes  the  user  to  the 
confirmation  process,  described  below 

If  one  of  the  conclusions  does  suit  the  situation,  the  user  selects  the  associated  checkbox  to  the 
left  of  the  description  and  proceeds  to  the  pre-conditions  screen 

The  user  can  obtain  additional  information  about  a  particular  conclusion  by  pausing  the 
mouse  pointer  over  top  of  that  description  A  pop-up  window  appears  with  a  more  detailed 
description  of  the  failure  This  feature  keeps  the  quantity  of  text  in  the  window  to  a  minimum 
and  eliminates  the  need  to  scroll 


Pre-Condition  Screens 

A  pre-condition  screen  appears  after  the  user  has  chosen  one  of  the  possible  failures  in  a 
conclusion  window  and  clicked  the  “Next”  button  In  the  first  part  of  this  screen  is  a  list  of 
the  most  likely  pre-conditions  given  the  type  of  failure  that  occurred  The  next  section 
contains  general  pre-conditions  that  could  be  factors  in  any  type  of  failure  Each  item  in 
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these  sections  has  a  Yes  or  No  option  next  to  it  that  can  be  selected  according  to  whether  or 
not  the  user  believes  that  item  contributed  to  the  failure 

The  last  question  on  the  screen  asks  whether  the  user  believes  there  are  other  pre-conditions 
that  may  have  played  a  role  in  the  failure  If  “Yes”  is  selected  then  the  next  screen  in  the 
process  will  be  the  “Additional  Pre-Conditions”  screen,  described  below  Otherwise,  the 
questioning  continues  at  the  top  of  the  next  branch  of  the  decision  tree 


Additional  Pre-Conditions  Screen 

This  screen  is  invoked  when  the  user  indicates  from  the  pre-conditions  screen  that  there  are 
additional  pre-conditions  that  do  not  fall  into  any  of  the  pre-defmed  SERA  categories  There 
are  two  text  areas,  each  allowing  the  entry  of  an  additional  pre-condition  If  there  are  three  or 
more  to  enter,  any  remaining  ones  can  be  typed  in  the  third  text  area  To  the  right  of  each  of 
these  boxes  is  an  associated  text  area  to  accommodate  an  explanation  of  why  the  user  believes 
that  pre-condition  was  a  factor  in  the  accident 


Confirmation  Process  Screens 

The  confirmation  process  is  undertaken  when  the  user  finds  that  the  possible  conclusions 
offered  by  the  software  are  not  consistent  with  his  or  her  understanding  of  the  accident 
situation  The  final  choice  in  each  conclusion  screen  is  checked  when  the  user  feels  that  none 
of  the  conclusions  is  appropriate  to  the  situation  When  the  associated  checkbox  is  selected 
and  the  “Next”  button  is  pressed,  the  software  presents  the  user  with  a  series  of  screens 
summarizing  each  question  and  the  user’s  answer  For  each  one,  “Yes”  or  “No”  can  be 
pressed  to  indicate  whether  the  original  answer  was  correct  or  not  The  process  can  be  stopped 
at  any  time  by  clicking  the  “Cancel”  button,  whereupon  the  user  is  returned  to  the  conclusion 
screen  that  was  displayed  before  the  confirmation  process  began 

If,  during  the  process,  the  “No”  button  is  pressed,  the  user  is  returned  to  that  earlier  question 
so  that  the  answer  can  be  revised  Alternatively,  if  all  of  the  questions  are  answered  “Yes” 
then  the  original  responses  are  judged  to  be  correct  and  the  user  has  the  option  of  re¬ 
examining  his  or  her  choice  of  conclusions,  starting  over,  or  exiting  the  application 


Analysis  Completion  Screen 

When  the  investigator  has  finished  answering  all  of  the  questions  in  the  decision  tree,  a  screen 
is  presented  to  inform  him  that  the  analysis  is  complete  At  this  point,  the  user  has  the  option 
of  viewing  a  report  summarizing  the  findings  of  the  analysis  or  reviewing  the  additional  pre¬ 
conditions 
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View  Report  Screen 

This  screen  is  accessed  from  the  “Analysis  Completion”  screen  and  can  also  be  viewed  at  any 
point  in  the  process  by  selecting  the  “View  Report”  option  in  the  “View”  menu  It  presents  a 
report  summarizing  the  current  results  of  the  analysis  The  contents  of  this  report  can  be 
output  to  a  text  file  by  selecting  “Export  ”  in  the  “File”  menu 

The  report  is  divided  into  three  sections  corresponding  to  the  three  branches  of  the  decision 
tree  perception,  goal  (intent)  and  action  Within  each  section,  the  user’s  responses  and  the 
failures  and  pre-conditions  are  listed  The  questions  and  answers  are  rephrased  as  statements 
to  facilitate  the  integration  of  this  information  into  an  investigator’s  personal  report  Pre¬ 
conditions  are  grouped  according  to  whether  the  user  answered  “yes,”  “no”  or  neither 


Review  “Other”  Pre-conditions 

This  screen  is  accessible  through  a  button  in  the  “Analysis  Completion”  screen  It  provides  a 
simple  mechanism  by  which  the  user  can  return  to  the  “Additional  Pre-conditions”  screens  to 
revise  or  add  to  those  responses  This  option  was  incorporated  to  give  the  user  additional 
flexibility  in  the  timing  of  tins  input 
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The  SERA  Flowchart  Window 


The  flowchart  window  appears  to  the  right  of  the  mam  window  and  gives  a  graphical 
overview  of  the  decision  tree  It  tells  users  at  a  glance  where  they  are  in  the  process  and 
where  they  have  been 


Node  and  Link  Representations 

In  the  flowchart,  questions  are  represented  as  blue  rectangles  Conclusions  start  out  as  blue 
circles,  but  when  a  particular  failure  is  identified  during  the  analysis,  that  circle  becomes  a  red 
six-pointed  star  to  facilitate  rapid  identification  of  failures  in  the  flowchart  Pre-conditions 
appear  as  blue  ellipses  m  this  window  “Yes”  answers  to  questions  are  shown  as  green  links, 
and  “no”  answers  appear  red  to  enable  the  user  to  quickly  see  where  in  the  decision  tree  a 
particular  response  will  lead 

At  the  start  of  the  process,  the  shapes  in  the  flowchart  are  drawn  only  in  outline  As  the  user 
answers  questions,  those  nodes  are  filled  in,  clearly  showing  the  path  that  the  user  has 
followed  The  node  corresponding  to  the  currently-displayed  information  is  drawn  with  a 
bold  outline  When  the  user  returns  to  a  previous  node  m  the  flowchart,  the  bold  outline 
moves  to  reflect  the  change  to  the  current  focus  and  the  shading  remains  in  place  for  all  other 
answered  nodes  to  indicate  where  in  the  tree  the  user  has  been 


Legend  and  Labelling 

In  the  upper,  left-hand  comer  of  the  flowchart  window  is  a  legend  which  identifies  the  various 
shapes  and  colours  of  the  nodes  and  links  in  the  flowchart,  and  what  they  represent  The  three 
branches  of  the  decision  tree,  corresponding  to  Perception,  Goal  (Intent)  and  Action,  have 
been  labelled  to  further  provide  context  for  the  user 


Sizing  and  Scalability 

The  flowchart  w  indow  is  scalable  to  allow  the  user  to  expand  or  contract  it  according  to  the 
screen  space  available  Restrictions  on  the  minimum  size  of  the  window  have  been  imposed 
to  prevent  reducing  the  window  beyond  the  point  of  legibility 
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Flowchart  Navigation  and  Associated  Constraints 

In  addition  to  providing  a  graphical  depiction  of  the  user’s  location  in  the  process,  one  of  the 
primary  purposes  of  the  flowchart  window  is  to  allow  the  user  to  navigate  to  any  point  in  the 
analysis  with  a  click  of  the  mouse  button 

The  user  is  able  to  navigate  to  any  screen  that  has  already  been  visited,  corresponding  to 
nodes  that  are  shaded  in  the  flowchart  Additionally,  the  first  question  in  each  of  the  three 
branches  of  the  decision  tree  can  always  be  clicked  This  allows  the  user  full  flexibility  for 
beginning  the  questioning  in  any  of  the  three  branches  Unshaded  nodes  below  these 
questions  cannot  be  selected  because  the  software  cannot  determine  a  unique  path  when  the 
yes  and  no  questions  above  have  not  been  answered 
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Menu  Commands 


It  is  standard  for  applications  to  have  at  least  a  “File”  menu,  an  “Edit”  menu  and  a  “Help” 
menu  SERA  has  these,  as  well  as  a  “View”  menu  For  maximum  usability,  the  menus  have 
been  designed  to  contain  the  typical  items  users  expect  to  see  The  remainder  of  this  section 
contains  descriptions  of  the  various  menu  items  for  each  of  the  SERA  menus 


File  Menu 

The  “New”  command  in  this  menu  allows  the  user  to  clear  all  of  the  current  answers  and  start 
over  with  a  blank  report 

The  “Open”  command  presents  the  user  with  a  standard  file  dialog  box  and  will  open  up  a 
selected  report  that  was  previously  stored  using  the  “Save”  command 

The  “Save”  menu  item  stores  all  of  the  information  that  has  been  entered  in  the  current  report 
in  a  single  file  This  file  uses  a  proprietary  file  format  that  is  not  designed  to  be  human- 
readable  or  editable  The  exact  state  of  the  software  is  preserved  when  this  command  is 
invoked 

When  the  user  wishes  to  specify  a  new  name  for  the  file,  the  “Save  As  ”  command  will 
allow  this 

The  “Export  ”  command  will  output  a  summary  of  the  results  of  the  SERA  analysis  to  a  text 
file 

The  “Quit”  menu  item  allows  the  user  to  exit  the  application 


Edit  Menu 

The  “Edit”  menu  items  function  as  they  do  m  most  applications  These  commands  allow  the 
user  to  manipulate  text  in  the  editable  text  boxes  within  the  software 

The  “Cut”  command  deletes  the  currently  selected  text  and  places  it  in  the  clipboard,  while 
the  “Copy”  menu  item  copies  it  to  the  clipboard  without  deleting  it  first  The  “Paste” 
command  inserts  the  contents  of  the  clipboard  at  the  current  location  of  the  insertion  point 
The  “Clear”  command  deletes  the  text  currently  selected  The  “Select  All”  command  allows 
the  user  to  select  all  of  the  text  in  the  text  area  that  is  currently  being  edited 
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View  Menu 

The  “View”  menu  allows  the  user  to  select  between  two  different  viewing  modes  in  the 
application  When  the  programme  is  first  launched,  it  is  in  “View  Questionnaire”  mode 
Through  the  “View”  menu  the  user  can  toggle  to  “View  Report”  mode  and  back  to  the 
questionnaire  This  enables  the  user  to  examine  a  summary  of  the  findings  at  any  point  in  the 
process  and  return  to  the  questions  without  losing  her  place 


Help  Menu 

The  “About  SERA”  menu  item  invokes  the  SERA  splash  screen,  described  previously 

The  “Page  Help”  option  brings  up  a  help  screen  with  information  relevant  to  the  current 
window,  if  such  help  is  available 

In  the  Macintosh  version  of  SERA,  the  system  automatically  inserts  three  additional 
menu  items  at  the  top  of  the  “Help”  menu.  The  first  two,  “About  Balloon  Help”  and 
“Show/Hide  Balloons”  are  standard  Macintosh  menu  commands  available  in  all 
applications.  The  third  item,  “Show/Hide  Contextual  Menus”  has  no  functionality  in 
this  software.  These  menus  do  not  appear  in  the  Windows  version  of  SERA. 
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Storage  of  Textual  and  Flowchart  Data _ 

The  software  was  designed  to  allow  convenient  modification  of  all  textual  information 
presented  in  the  programme  This  material  is  stored  in  a  single  editable  text  file,  which  means 
that  there  is  no  need  to  modify  programme  code  in  order  to  revise  the  questions,  conclusions, 
pre-conditions  or  help  information 

Also  stored  in  this  file  is  information  about  the  logic  of  the  decision  trees  and  the  geometry  of 
the  flowchart  This  leads  to  the  possibility  of  modifying  not  only  text,  but  the  sequence  of 
questions  and  conclusions,  or  even  the  entry  of  additional  questions  Some  of  these  changes 
could  require  minor  modifications  to  the  programme  code,  but  future  versions  of  the  software 
could  allow  full  flexibility  in  this  regard 

The  text  file  is  divided  into  separate  entries  corresponding  to  the  various  screens  in  the 
software,  and  they  are  delimited  by  strings  of  pound  (“#”)  symbols  Each  entry  contains  some 
or  all  of  the  following  information,  depending  on  the  type  of  screen  to  which  it  corresponds 
the  text  of  the  question,  conclusion,  pre-conditions  or  help,  position  in  the  flowchart,  title  for 
the  “additional  remarks”  area,  and  a  re-wording  of  the  question  m  the  form  of  a  statement  for 
entry  into  the  report 
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File  Input  and  Output _ 

Proprietary  File  Format  to  Save  and  Restore  the  Current  State 

The  current  state  of  the  analysis  can  be  stored  at  any  time  using  the  “Save”  or  “Save  As  .  ” 
command  in  the  “File”  menu,  and  can  be  retrieved  later  using  the  “Open”  command  m  the 
same  menu  This  capability  makes  use  of  a  proprietary  file  format  to  store  all  data  that  have 
been  entered  by  the  user  This  includes 

•  answers  to  the  introductory  questions  (author,  unit,  title,  description,  dates  and 
times), 

•  textual  answers, 

•  answers  to  the  “yes”  or  “no”  questions, 

•  conclusion  choices, 

•  pre-condition  information, 

•  additional  remarks 


Exporting  the  Report  to  a  Text  File 

The  report  that  is  available  to  the  user  at  the  end  of  the  analysis  can  be  output  to  a  text  file 
through  the  use  of  the  “Export  ”  command  in  the  “File”  menu  A  discussion  of  the  format  of 
this  report  is  found  under  “View  Menu”  in  the  “Menu  Items”  section,  above 
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Standard  Help  System _ 

There  are  three  components  to  the  standard  help  system  in  SERA  contextual  help  is  available 
for  specific  pages,  help  windows  display  detailed  information  about  failures,  and  there  is  a 
single  help  screen  providing  background  information  about  perceptual  control  theory 


Contextual  help 

Contextual  help  is  available  for  all  of  the  question,  conclusion  and  pre-conditions  screens 
The  content  of  the  help  is  derived  from  Hendy’s  PCTACT  (SERA)  report  As  such,  it  mostly 
provides  general  information  on  the  SERA  process  and  lacks  specific  guidance  on  the  use  of 
the  software  Future  work  on  SERA  could  address  this  issue 

There  are  two  methods  of  invoking  contextual  help  clicking  the  question  mark  icon  in  the 
upper  right-hand  comer  of  the  window  and  selecting  “Page  Help”  in  the  “Help”  menu  The 
help  appears  using  a  horizontal  blind  transition  effect  It  can  be  dismissed  by  clicking  the 
“Return”  button,  or  by  clicking  anywhere  in  the  window  The  help  information  is  dismissed 
using  a  reverse  horizontal  blind  effect  If  a  particular  screen  lacks  a  question  mark  icon,  there 
is  no  help  available  for  that  screen 


Pop-up  Windows  Containing  Supplementary  Information 
about  Failures 

In  any  of  the  conclusion  screens,  the  user  can  pause  the  cursor  over  a  particular  conclusion  to 
bring  up  a  window  containing  a  more  detailed  description  The  cursor  must  pause  for 
approximately  a  second  before  the  help  window  will  appear,  to  reduce  the  likelihood  that  a 
user  might  trigger  it  unintentionally  When  a  help  window  is  displayed,  the  user  cannot 
proceed  until  this  window  has  been  dismissed  by  clicking  anywhere  within  its  boundaries 

The  descriptions  of  the  failures  are  taken  from  Annex  B  of  Hendy  ’s  report  The  first  sentence 
about  each  failure  appears  in  the  mam  conclusion  window  and  gives  a  brief  description  of  that 
item  This  allows  the  user  to  view  all  of  the  choices  without  the  need  to  scroll  The  full  text 
of  the  description  appears  in  the  pop-up  window,  which  is  sized  according  to  the  amount  of 
text  to  be  displayed  and  positioned  to  appear  below  the  description  in  the  main  window 


Perceptual  Control  Theory  Overview 

In  the  introductory  screen  the  user  can  click  on  the  astcriskcd(*)  PCT  label  in  the  lower  left- 
hand  comer  to  bring  up  a  screen  containing  a  brief  overview  of  Perceptual  Control  Theory 
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This  feature  was  added  because  many  users  will  not  have  had  prior  exposure  to  this  theory, 
and  some  understanding  of  it  is  necessary  in  order  for  users  to  provide  meaningful  answers  to 
the  questions  m  the  SERA  analysis 
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Intelligent  and  Adaptive  Help _ 

The  goal  of  the  intelligent  and  adaptive  help  component  of  this  contract  was  limited  largely  to 
creating  an  infrastructure  to  track  user  actions  and  exploring  how  that  infrastructure  could  be 
used  to  add  adaptive  functionality  to  future  versions  of  the  software  One  simple  mechanism 
was  incorporated  in  this  version  but  future  work  could  create  a  more  comprehensive  help 
system  Some  of  these  are  described  in  the  “Opportunities  for  Future  Enhancements”  section 
below 

To  lay  the  groundwork  for  an  intelligent  and  adaptive  aiding  system,  user  interface  actions  are 
monitored  by  the  software  These  include  activities  such  as  clicking  the  mouse  on  a  push¬ 
button,  selecting  a  checkbox,  and  choosing  a  “Yes”  or  “No”  answer  The  context  of  the 
action  is  also  stored,  including  the  interface  object  involved,  where  the  user  is  in  the  process, 
and  time-stamp  information 

Future  work  could  extend  interface  monitoring  to  include  inference  of  the  user’s  goal  m 
performing  a  particular  action,  and  making  judgements  about  how  that  action  might  fit  into  a 
larger  plan  That  information  could  then  be  used  to  determine  what  the  user  is  trying  to 
accomplish  and  thereby  providing  the  basis  for  assistance  to  farther  that  aim  This  could 
include  queries  to  validate  the  user's  intended  plan,  help  descriptions  tailored  to  the  pursuit  of 
that  plan  and,  even  automation  of  select  processes  in  the  service  of  the  user’s  goals 

A  simple  example  of  a  current  intelligent  help  capability  is  the  provision  for  help  when  there 
is  a  long  delay  without  input  from  the  user  The  software  implicitly  infers  from  this  delay  that 
the  user  may  be  having  trouble  deciding  how  to  proceed  and  therefore  should  be  offered 
assistance  The  system  then  displays  a  help  dialog  box  asking  if  help  is  needed  and,  if  so, 
takes  the  user  to  a  help  page  specific  to  that  context 

If  a  user  is  collecting  information  in  the  field,  there  may  be  delays  as  materials  are  being 
gathered  To  prevent  this  help  feature  from  becoming  a  nuisance  to  the  investigator,  these 
automatic  messages  may  be  disabled  by  clicking  a  standard.  “Don’t  Show  Again”  checkbox 
before  dismissing  the  window 

Since  the  user’s  actions  are  being  tracked,  there  is  the  potential  for  the  system  to  determine 
whether  a  user  has  gone  back  to  revise  earlier  responses  In  future,  this  fact  could  be  used  as 
an  indication  that  the  user  is  experiencing  confusion  about  how  to  answer  the  questions,  and 
the  system  could  offer  appropriate  help  This  feature  was  considered  for  implementation  in 
the  current  version  of  the  software,  but  it  was  determined  that  a  more  fundamental  issue 
should  take  precedence,  namely  resolving  conflicts  between  the  system’s  conclusions  and  the 
user’s  understanding  of  the  accident  situation  Consequently,  a  “confirmation  mechanism” 
for  resolving  those  conflicts  w  as  designed  and  implemented  as  part  of  the  current  work 


Also  considered  for  the  help  system  was  the  possibility  of  incorporating  an  information 
retrieval  agent  Because  the  software  has  been  written  in  Java,  it  is  well  suited  to  the 
integration  of  an  agent  technology  to  access  the  internet  Since  the  information  on  the  world- 
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wide-web  is  constantly  changing,  there  is  the  potential  for  retrieving  more  current  information 
about  failures  and  pre-conditions  than  could  be  obtained  using  a  static  help  system. 

Discussions  were  held  regarding  possible  designs  for  such  an  agent.  Prior  experience 
constructing  information-retrieval  agents  in  other  contexts  would  facilitate  the  design  and 
implementation  of  an  agent  for  SERA  Initial  work  could  allow  the  automated  searching  of 
one  or  more  general  Internet  search  engines  A  second  phase  could  incorporate  the  retrieval 
of  information  directly  from  sites  with  content  that  is  specific  to  accident  investigation 
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HFACS  Equivalents  and  Database  Output _ 

All  of  the  failures  and  pre-conditions  have  been  associated  with  equivalents  from  the  AGA 
135  HFACS  accident  investigation  system  currently  used  by  the  Canadian  Forces  The 
category  equivalents  were  derived  from  Tables  3  through  6  in  Hendy’s  report  That 
information  is  incorporated  into  the  report  that  SERA  produces  at  the  end  of  each  analysis 
For  each  failure  and  pre-condition,  the  name  of  the  equivalent  HFACS  category  is  provided 

An  original  goal  for  this  contract  was  to  link  this  software  with  a  database  of  accidents  that 
have  been  investigated  using  the  HFACS  approach  As  a  consequence  of  other  work  on  the 
project  and  after  discussions  with  the  Scientific  Authority,  specifications  for  how  that 
information  is  to  be  organised  for  inclusion  into  a  database  and  the  implementation  of  that 
function  were  deferred  to  future  contract  work 

The  exported  report  at  the  end  of  the  analysis  contains  all  of  the  information  that  would  be 
contained  in  a  database  entry  In  future,  when  a  format  for  the  database  has  been  determined, 
the  software  could  be  modified  to  output  the  report  in  a  form  suitable  to  that  database 
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Contract  Extension 


Upon  completion  of  the  first  phase  of  the  SERA  work  it  w  as  determined  that  several  features 
were  missing  from  the  programme  —  features  that  had  emerged  as  essential  to  the  software 
but  which  had  not  been  included  among  the  original  work  items  The  contract  was  extended 
to  allow  for  the  inclusion  of  these  items,  which  are  described  below 


Remarks  for  the  Individual  Pre-conditions 

One  feature  the  original  SERA  implementation  lacked  was  the  ability  to  enter  remarks  for 
each  pre-condition  This  is  important  because  there  is  a  need  for  the  investigator  to  justify 
why  a  particular  factor  was  or  was  not  a  precursor  to  the  failure  that  occurred 

In  order  to  avoid  interface  cluttering,  an  approach  was  devised  that  permitted  the  use  of  the 
existing  area  for  typing  in  comments  in  the  pre-conditions  window  When  the  window  first 
appears,  the  heading  above  that  text  area  indicates  the  pre-condition  to  which  the  remarks 
apply,  e  g  ,  “Additional  Remarks  for  MONITORING  AND  SUPERVISION  ”  As  the  user 
answers  yes  or  no  to  the  remaining  questions,  the  heading  changes  to  indicate  that  the  remarks 
apply  to  that  pre-condition  and  the  contents  of  the  text  area  update  accordingly. 


HFACS  Equivalent  Categories 

The  original  implementation  of  SERA  had  the  capability  of  generating  a  report  detailing 
equivalent  HFACS  terminology  for  each  conclusion  and  pre-condition  based  on  the  SERA- 
HFACS  mappings  given  m  tables  3  through  6  of  Hendy’s  (2002)  report  This  arrangement 
gave  no  flexibility  for  the  investigator  to  tailor  HFACS  results  to  the  particular  accident  under 
investigation  As  a  consequence,  a  way  was  devised  to  override  the  suggested  equivalents 

That  capability  was  incorporated  through  the  addition  of  an  “HFACS”  button  in  the 
conclusion  and  pre-condition  w  indows  When  selected,  the  button  invokes  a  new  “HFACS 
Equivalents”  w  indow  containing  a  list  of  the  24  categories  from  the  AGA  135  HFACS 
standard  Each  item  has  an  associated  checkbox  and,  when  the  window  first  opens,  Hendy’s 
suggested  equivalents  are  pre-selected  The  user  then  has  full  flexibility  to  deselect  any 
default  categories  that  are  not  suitable  and  to  select  other  items  that  are  relevant  to  the 
particular  conclusion  or  pre-condition 

In  the  conclusion  window',  the  “HFACS”  button  is  dimmed  and  cannot  be  selected  until  the 
user  has  chosen  one  of  the  possible  failures  In  the  pre-conditions  window,  answering  one  of 
the  “yes”  or  “no”  questions  changes  not  only  the  mode  of  the  remarks  area,  described  above, 
but  also  tells  the  system  the  pre-condition  to  which  the  HFACS  equivalents  apply 
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It  is  important  to  note  that  the  same  24  HFACS  categories  are  available  for  both  the 
conclusions  and  pre-conditions  While  it  is  the  case  that  certain  HFACS  categories  are 
associated  with  failures  and  others  relate  to  pre-conditions,  Hendy  has  demonstrated  that  there 
are  situations  where,  for  example,  a  SERA  failure  will  be  equivalent  to  an  HFACS  pre¬ 
condition  It  is  for  this  reason  that  all  HFACS  choices  are  made  available  to  the  user  each 
time  the  window  is  invoked,  giving  the  investigator  maximum  flexibility 

To  complete  the  implementation  of  the  new  HFACS  support  and  the  remarks  for  the 
individual  pre-conditions,  data  structures  were  added  to  store  this  extra  information 
Furthermore,  the  Save  and  Open  commands  were  modified  to  accommodate  the  additional 
data  and  compatibility  with  the  original  file  format  was  maintained  so  that  old  data  files  could 
still  be  opened  Lastly,  the  report  output  was  altered  to  integrate  the  new  data 


Report  Output 

The  format  of  the  report  output  required  modifications,  both  to  accommodate  the  new 
information  mentioned  above  and  to  enhance  readability  Conclusions  were  re-organised  so 
that  the  type  of  failure  was  followed  immediately  by  the  HFACS  equivalent  information, 
which  in  turn  was  followed  by  any  remarks  entered  by  the  user  This  format  has  the 
advantage  of  grouping  the  information  logically  instead  of  presenting  it  topically,  thus 
eliminating  the  need  for  the  user  to  jump  to  various  parts  of  the  report  for  related  information 
The  same  re-organisation  was  applied  to  the  pre-conditions 

Wordings  in  the  report  were  also  changed  to  improve  readability  The  descriptions  of  the 
conclusions  and  pre-conditions  were  minimised  to  reduce  the  length  of  the  report  and  the  pre¬ 
conditions  were  re-worded  so  that  they  appear  as  statements  rather  than  questions 

In  response  to  user  feedback  on  the  readability  of  the  report,  an  extra  sentence  was  added 
before  each  set  of  pre-conditions  answered  “No  ”  The  change  was  made  to  indicate  more 
clearly  that  those  are  factors  that  do  not  contribute  to  the  accident  under  investigation  The 
added  sentence  reads.  “NOTE  These  pre-conditions  ARE  NOT  considered  to  be 
contributory  ” 
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Implementation  Platforms _ 

Candidate  implementation  software  were  C  and  Java  running  on  Microsoft  Windows 
platforms  Although  the  SERA  tool  could  be  developed  using  a  wide  variety  of  other 
software  languages,  e  g  ,  Visual  Basic,  it  was  decided  that  the  use  of  C  or  Java  would  allow 
greater  flexibility  for  future  enhancements  Both  languages  allow  for  portability  to  other 
hardware  platforms  and  integration  with  software  agents  The  use  of  Java  permits 
implementation  as  both  a  stand-alone  application  and  as  an  applet  accessed  via  the  world- 
wide-web  and  executed  in  a  web  browser 

Java  was  chosen  for  this  implementation  because  it  is  the  more  portable  of  the  two  languages, 
thus  providing  the  most  flexibility  for  future  Internet  capabilities  The  Windows 
compatibility  enables  the  software  to  run  on  the  majority  of  laptop  computers,  thus  giving 
greater  scope  for  use  in  the  field 

The  first  phase  of  SERA  development  took  place  on  the  Macintosh  using  Metrowerks 
CodeWarrior  software  It  was  then  ported  to  the  Windows  platform  using  Metrowerks  for  the 
PC  As  expected,  modifications  to  the  Java  programme  were  necessary  due  to  differences  in 
the  behaviour  of  the  two  operating  systems  Contract  extension  work  followed  a  similar  path 
of  intial  development  on  the  Macintosh  and  a  subsequent  port  to  Windows  on  the  PC 
Versions  for  both  platforms  are  now  available 

The  flexibility  of  Java  is  unmistakable  Due  to  its  portability,  there  is  the  potential  in  future  to 
produce  versions  of  SERA  that  would  run  on  Sun  Solaris  systems,  UNIX/LINUX  boxes, 
Windows  CE  and  other  PDAs,  and  even  m  browsers  over  the  web 
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Opportunities  for  Future  Enhancements 


Future  work  on  the  software  could  encompass  some  or  all  of  the  following  items 


Add  support  for  stylised  text 

This  would  enable  bold,  italic  and  underlined  text  to  be  used  m  the  questions,  conclusions  and 
help  descriptions 


Implement  an  automatic  save  mechanism 

This  could  be  designed  to  automatically  save  a  backup  file  periodically  while  the  investigator 
is  conducting  an  analysis  In  the  event  of  a  system  crash,  most  if  not  all  of  the  entered 
information  could  be  recovered  from  this  file  the  next  time  the  application  was  launched, 
much  as  it  is  handled  in  Microsoft  Word,  for  example 


Implement  a  Palm  or  PocketPC  version 

This  would  allow  a  user  to  perform  a  SERA  analysis  in  the  field  using  a  PDA  or  other 
handheld  device 


Create  a  web  site  implementation 

Because  the  software  has  been  written  in  Java,  much  of  the  interface  could  be  adapted  for  use 
on  a  web  site  with  minimal  modifications  to  the  programme  code  One  major  area  that  would 
need  to  be  redesigned  w  ould  be  the  storage  of  the  report  at  the  end  of  the  analysis  This  is  due 
to  security  restrictions  imposed  in  Java  that  prevent  programmes  that  are  running  in  a  web 
browser  from  accessing  a  user’s  local  hard  drive 


Incorporate  risk  management  analysis 

Hendy’s  report  discusses  methods  for  applying  the  perceptual  control  theory  to  risk 
management  assessments  These  techniques  could  be  incorporated  into  a  future  release  of  the 
SERA  software 
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Validate  the  theory 

A  study  could  be  done  to  systematically  compare  the  results  of  SERA  analyses  with  those  of 
an  established  accident  classification  tool  such  as  HFACS  Statistical  analysis  could  shed 
light  on  the  efficacy  of  the  SERA  approach 


Create  pop-up  labels  in  the  flowchart  window 

This  would  provide  pop-up  description  labels  in  the  flowchart  window  when  the  user  paused 
the  mouse  pointer  over  a  particular  node 


Expand  the  contextual  help  materials 

The  material  in  the  contextual  help  system  would  benefit  from  revisions  and  additions  The 
current  help  has  general  information  about  the  SERA  process,  but  lacks  specific  material  on 
the  features  and  use  of  the  software  tool  One  or  more  “instructions”  screens  could  be  added, 
as  well  as  more  detailed  descriptions  of  the  individual  pre-conditions 


Extend  the  tracking  capabilities 

The  help  system  could  be  extended  to  allow  more  elaborate  tracking  of  user  actions  In  the 
current  version  of  the  software,  certain  interface  actions  are  not  monitored,  such  as 
repositioning  windows  or  moving  the  mouse  over  a  “Yes”  or  “No”  button  causing  it  to  be 
highlighted  This  information  could  be  incorporated  into  a  model  of  the  user 


Intelligent  Adaptive  Aiding 


Future  work  on  the  help  system  could  incorporate  a  user  model  that  would  maintain  a 
database  of  different  users,  their  habits  and  preferences  The  system  could  draw  inferences 
about  a  user’s  capabilities  and  knowledge  based  on  that  information,  and  the  results  of  such 
inferences  could  provide  a  basis  for  adaptive  interfacing  For  example,  if  the  system 
determined  that  a  user  had  a  large  amount  of  experience  with  the  software,  the  descriptions  of 
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failures  and  pre-conditions  could  be  shortened  thereby  simplifying  the  display  and  reducing 
the  need  for  scrolling  On  the  other  hand,  if  the  user  was  a  comparative  novice  the  system 
could  provide  detailed  descriptions  and  additional  instructions  Such  knowledge  of  a  user’s 
proficiency  could  determine  tire  level  of  help  to  offer  in  other  contexts 

One  other  useful  form  of  intelligent  help  to  the  SERA  user  would  involve  comparing  the 
results  of  the  analysis  with  previous  results  to  identify  similarities  This  “case-based” 
approach  could  be  accomplished  through  pattern-matching  in  the  database  of  previous  reports 
By  drawing  the  user’s  attention  to  other  reports  where  the  same  or  similar  types  of  failure 
have  occurred,  the  investigator  might  discover  valuable  insights  m  the  factors  that  other  users 
have  considered  in  similar  accident  situations 

Another  future  enhancement  could  provide  help  to  the  user  when  an  action  is  performed  that 
has  no  effect  Examples  of  this  type  of  action  include 

•  clicking  the  dimmed  “Next”  button  when  neither  “Yes”  nor  “No”  has  been 
selected  in  a  question  screen,  or 

•  clicking  a  node  in  the  flowchart  that  has  not  yet  been  visited  and  not  at  the  top  of 
one  of  the  three  branches 

The  system  could  detect  these  actions  and  provide  information  detailing  why  they  had  no 
effect 
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Annexes 


1  Annotated  List  of  SERA  Source  Code  Files 
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ColIage.jpg 

•  This  image  file  contains  the  collage  that  is  displayed  on  the  splash  screen. 

Dialogs,  java 

•  This  file  contains  the  Java  code  for  the  dialogue  boxes,  including  the  HFACS 
window,  the  help  prompt,  the  pop-up  help  windows  and  the  “save  changes” 
prompt. 

Flow  chart  java 

•  This  file  contains  the  Java  code  necessary  for  the  SERA  Flowchart  window. 

Main.java 

•  This  file  contains  the  Java  code  that  serves  as  the  main  entry  point  when  the 
application  is  launched. 

MainWindow.java 

•  This  file  contains  the  Java  code  necessary  for  the  main  SERA  window. 

SERA.mcp 

•  This  is  the  Metrowerks  CodeWarrior  project  file. 

Title.jpg 

•  This  image  file  contains  the  graphic  of  the  SERA  title  that  is  displayed  above  the 
collage  on  the  splash  screen  and  at  the  top  of  all  subsequent  screens. 

Tree.txt 

•  This  file  contains  the  text  of  questions,  conclusions  and  pre-conditions,  as  well 
as  information  on  the  relationships  among  the  nodes  in  the  SERA  decision  tree. 
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14.  ABSTRACT 

A  software  tool  was  designed  and  implemented  that  leads  accident  investigators  through  the  steps  of  a 
Systematic  Error  and  Risk  Analysis  (SERA),  a  classification  scheme  based  on  Perceptual  Control  Theory 
and  developed  at  DRDC  Toronto  The  software  presents  an  investigator  with  a  series  of  questions  about 
an  accident  and  generates  conclusions  about  the  nature  of  the  failure  and  its  probable  pre-conditions  A 
graphical  depiction  of  the  decision  tree  allows  users  to  navigate  easily  among  the  steps  of  the  analysis  At 
the  end  of  the  process,  the  software  produces  a  report  detailing  failures  and  pre-conditions,  and  providing 
equivalent  terminology  from  the  AGA  135  HFACS  classification  scheme 

A  help  system  was  developed  that  makes  context-sensitive  help  available  to  the  user  at  various  stages  of 
the  process  In  preliminary  work  to  lay  a  foundation  for  intelligent  aiding,  users’  activities  are  tracked  by 
the  software  in  a  way  that  can  be  used  in  future  to  provide  intelligent  and  adaptive  help  To  illustrate  the 
potential  use  of  the  tracking  mechanism,  the  software  was  designed  to  monitor  user  actions  and  offer  help 
whenever  there  is  a  long  delay  without  input 


RESUME 

On  a  con^u  et  mis  en  oeuvre  un  outil  logiciel  qui  aide  les  enqueteurs  d’accident  a  executer  les  etapes  d’une 
analyse  systematique  des  erreurs  et  du  risque  (SERA),  systeme  de  classification  base  sur  les  principes  du 
controle  perceptif  et  developpe  par  le  RDDC  Toronto  Le  logiciel  presente  a  l’enqueteur  une  serie  de 
questions  sur  un  accident  et  genere  des  conclusions  sur  la  nature  de  la  defaillance  et  les  conditions 
prealables  probables  Une  representation  graphique  de  l’arbre  de  decision  permet  aux  utilisateurs  de 
naviguer  aisement  parmi  les  etapes  de  l’analyse  A  la  fin  du  processus,  le  logiciel  produit  un  rapport 
detaillant  les  defaillances  et  les  conditions  prealables  et  foumissant  la  terminologie  equivalente  du 
systeme  de  classification  du  SACn'  A  C  \  13 

On  a  developpe  un  systeme  d’aide  contextuelle  i>'  .,^ei  ~  ur  peut  avoir  recours  aux  diverses  etapes 

du  processus  Au  stade  txehminam  en  vue  d’etablir  une  fondation  pour  l’aide  intelligente,  les  activites 
des  utilisateurs  sont  suivit.  !e  p \  •-■r  le  cl  me  fa$on  qui  pourra  etre  utihsee  a  l’avemr  pour  offrir 

de  l’aide  intelligente  et  adaptative  A  fide  ,j;  .  jn  de  l’utilisation  potentielle  du  mecamsme  de  suivie 
des  activites,  le  logiciel  a  ete  co:.v,  po,,  L  U  es  actions  de  l’utihsateur  et  offrir  de  l’aide  lorsqu’il  y 
a  un  mtervalle  prolonge  sans  e.' u <’r- 
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